UK government proposes new IoT rules: firms must tell consumers how long security updates will be provided, ship individual devices with unique passwords, more
Proposed laws from the UK for Internet of Things security and suggests vendors will need to follow new rules to be considered secure.
ZDNetDanny Palmer
Context & Ripple Effects
This proposal lands four years after Dahua's hardcoded default passwords turned consumer IoT gear into the Mirai botnet that knocked out Krebs on Security — the incident that put device-level security on regulators' agendas. The UK's answer is disclosure-first: force vendors to state up front how long a device will receive updates, rather than banning specific flaws outright.
It also follows a wave of legislative first-moves elsewhere: a California "reasonable security" bill covering all new IoT devices and a US Senate bill requiring government-purchased devices to be patchable. The UK proposal extends that pattern from procurement niches to the whole consumer market.
First-order effects
IoT vendors selling into the UK must now publish a support-duration commitment per device and eliminate shared default credentials at the factory — turning update policy from a hidden internal decision into printed, comparable product labeling.
Devices with short or vague update windows become visibly riskier at point of sale, pressuring vendors with weak maintenance track records to either extend support or concede shelf space.
Second-order effects
Other jurisdictions are pushed to match or exceed the bar — the trajectory runs from California's broad statute through the EU's Cyber Resilience Act fines regime to the UK eventually banning default guessable passwords outright, so multi-market vendors converge on the strictest rule rather than fragmenting firmware by region.
Retailers and enterprise buyers gain a simple screening criterion (stated update length, no default passwords) they can write into purchasing terms, shifting enforcement from regulators to the supply chain itself.
Third-order effects
Security documentation becomes a condition of market access: the durable pattern across these bills is that a device without a declared update lifecycle is treated as unfit for sale, making compliance paperwork as central to IoT hardware as safety certification.
If disclosure norms hold, the industry structurally splits between vendors who can fund long support tails and those who cannot — consolidating the low-margin device market around firms with sustained update infrastructure.
The trend: IoT security regulation is moving worldwide from voluntary best practices toward binding law, with the UK's disclosure-and-unique-password proposal one step on the path from the Mirai era to enforced update lifecycles.
Today the UK @DCMS published results of its consultation on their IoT code of practice, and announced they're writing legislation around it. Some interesting notes from the announcement. https://www.gov.uk/...
In response to the Secure by Design consultation we are bringing in new measures to make sure smart devices have: ➡️Unique passwords ➡️Clear information about security updates ➡️Contact centre available to answer questions https://www.gov.uk/... https://twitter.com/...
New - IoT security: Your smart devices must have these three features to be secure @DCMS proposes laws on IoT security - although information on how they'll actually be implemented remains rather unclear... https://www.zdnet.com/... via @ZDNet
“Over 90% of 331 manufacturers, supplying the UK market, reviewed in 2018 did not possess a comprehensive vulnerability disclosure programme...” This is problematic as IoT security increasingly impacts national and economic security. https://twitter.com/...
Very relevant to the recent Sonos debate. Would have meant they would have been sold with an expiry date... Government to strengthen security of internet-connected products - http://gov.uk/ https://www.gov.uk/...
‘Citizens’ privacy and safety must not be put at risk because some manufacturers will not take responsibility for ensuring that security is built into their products before they reach UK consumers', says UK's Matt Harman, minister for digital https://www.gov.uk/...
Yet..no closer to working out who or how enforcement of proposed IoT device regulation would work. UK ‘is mindful of placing more responsibility on existing UK agencies at a time when resources are prioritised on existing consumer protection priorities’ https://www.gov.uk/...
This headline is wack (nothing should ever be considered “secure"), but any attempt at establishing some basics around IOT security should be applauded https://www.zdnet.com/...
UK government have today announced plans to regulate Internet of Things devices, aka poor product cybersecurity. “...it is now clear that decisive action is needed to ensure that strong cyber security is built into these products by design.” 👍🏾 https://www.gov.uk/...